Critical Safety Overview and Definitions

One of four levels to specify the item’s (1.69) or element’s (1.32) necessary requirements of ISO 26262 and safety measures (1.110) to apply for avoiding an unreasonable residual risk (1.97), with D representing the most stringent and A the least stringent level.

ISO 26262-9 describes ASIL analyses in detail!

Also called “ASIL Tailoring.” Apportioning of safety requirements redundantly to sufficiently independent elements (1.32), with the objective of reducing the ASIL (1.6) of the redundant safety requirements that are allocated to the corresponding elements.

“How to” example chart is in ISO26262-9 5.4.10

Failure (1.39) of two or more elements (1.32) of an item (1.69) resulting from a single specific event or root cause.

Common cause failures are dependent failures (DF) (1.22) that are not cascading failures (CF) (1.13).

Failure (1.39) of an element (1.32) of an item (1.69) causing another element or elements of the same item to fail.

Cascading failures are dependent failures (DF) (1.22) that are not common cause failures (CCF) (1.14).

Processing system that runs the same set of operations at the same time in parallel.

For ISO 26262 applications, the second “checker” core usually executes 1 or 2 clock ticks after the primary “reference” core to help ensure that power glitches will not simultaneously affect both cores, resulting in no detection of an error.

Failures (1.39) whose probability of simultaneous or successive occurrence cannot be expressed as the simple product of the unconditional probabilities of each of them.

Dependent failures include common cause failures (CCF) (1.14) and cascading failures (CF) (1.13).

ISO 26262-9 7 explains dependent failure analysis (DFA).

Agreement between customer and supplier in which the responsibilities for activities, evidence or work products to be exchanged by each party are specified.

An example DIA is at ISO 26262-5 B.

Amount of time between the executions of online diagnostic tests by a safety mechanism.

Use ISO 26262-5 Table D.1 for analysis.

Electrical overstress failures can be classified as thermally-induced, electromigration-related and electric field-related failures. Can result in a latchup short circuit.

Example of failure rate resulting from EOS is in ISO 26262-10 A.3.4.2.4.

Calculation methods are in IEC TR 62380, “Reliability data handbook – Universal model for reliability prediction of electronics components, PCBs and equipment”

A subclass of Electrical Overstress (EOS). The sudden flow of electricity between two electrically charged objects caused by contact, an electrical short, or dielectric breakdown.

See ISO 26262-5 E for example of SPFM and LFM calculations with ESD.

The number of failures that can be expected in one billion (1×10^9) device-hours of operation.

Mean time between failures (MTBF) = 1,000,000,000 x 1/FIT.

As opposed to fault tree analysis (FTA), failure mode and effects analysis (FMEA) is an inductive approach focusing on the individual parts of the system, how they can fail and the impact of these failures on the system. Analysis starts at faults, which can lead to errors and then failures.

Can be qualitative or quantitative.

As opposed to failure mode and effects analysis (FMEA), fault tree analysis (FTA) is a deductive approach starting with the undesired system behavior and determining the possible causes of this behavior.

Can be qualitative or quantitative.

The time between when a fault occurs and the system can transition to a safe state and be ready to experience another possible hazard.

Maximum FTTI = DTI + Fault Reaction Time + Safe State

Latent faults are multiple-point faults (1.77) whose presence are not detected by a safety mechanism (1.111) nor perceived by the driver within the multiple-point fault detection interval (MPFDI) (1.78). The latent fault metric (LFM) is a hardware architectural metric that reveals whether or not the coverage by the safety mechanisms, to prevent risk from latent faults in the hardware architecture, is sufficient.

Single point fault metric (SPFM) is the other hardware architectural metric.

·   ASIL B (≧60%), C (≧80%) and D (≧90%) coverage requirements are in ISO 26262-5 8.4.6 Table 5.

Equations and context are at ISO 26262-5 C.3.

Example for calculation is at ISO 26262-5 E.

When two or more error bits occur in the same word.

Cannot be corrected by simple single-bit ECC.

Is the sum of the single point, residual and multipoint fault metrics. Is expressed in FITs.

Calculation methods are described in ISO 26262-5 F.

A type of single event effect (SEE) caused by a single event upset (SEU) that causes a transient fault. This transient fault is “hard” and can only be corrected by cycling the power.

Causes include cosmic rays and electrostatic discharge (ESD).

A “soft error” caused by a single, energetic particle and can take on many forms. Causes “transient faults” like single event upsets (SEU), single event transients (SET) and single event latch-ups (SEL).

Use ISO 26262-5 Table D.1 for analysis.

Single point faults are faults (1.42) in an element (1.32) that are not covered by a safety mechanism (1.111) and that lead directly to the violation of a safety goal (1.108). The single point fault metric (SPFM) is a hardware architectural metric that reveals whether or not the coverage by the safety mechanisms, to prevent risk from single point faults in the hardware architecture, is sufficient.

Latent fault metric (LFM) is the other hardware architectural metric.

ASIL B (≧90%), C (≧97%) and D (≧99%) coverage requirements are in ISO 26262-5 8.4.5 Table 4.

Equations and context are at ISO 26262-5 C.2.

Example for calculation is at ISO 26262-5 E.

Use ISO 26262-8 11.4.5.5 Table 3 to calculate based on tool impact (TI) and tool error detection (TD).

Values are TCL1, TCL2 and TCL3.

The confidence in measures that prevent the software tool from malfunctioning and producing corresponding erroneous output, or in measures that detect that the software tool has malfunctioned and has produced corresponding erroneous output.

Values are TD1, TD2 and TD3.

The possibility that a malfunction of a particular software tool can introduce or fail to detect errors in a safety-related item or element being developed.

Values are TD1, TD2 and TD3.